Octeth v6.0.1 is out today.
Two weeks ago, v6.0.0 shipped bulk SMS as an engine: available through the API and in the admin area, but not yet on the screens your clients use. I said then that I would rather ship the engine when it was ready and the screens when they were ready. This release is the screens.
It also brings a new SMS gateway, a new licensing model with a free Community Edition, a sender domain health report, and controls that decide who is allowed to send through the email gateway in the first place.
Bulk SMS Campaigns In The New User Interface
Your clients can now create, price, test, send and schedule SMS campaigns from the new user interface. There is a campaign browser, a composer, a delivery report with link clicks, and an account-wide inbox for replies.
The part I care about most is the cost estimate. SMS is not like email, where one more message costs almost nothing. Every message has a price, and that price depends on the destination, the length of the message and the gateway. So the composer shows what a campaign will cost before anything leaves, and a campaign cannot be sent until its estimate is complete and current. If the message or the audience changes after pricing, the estimate has to be refreshed. A client should never be charged for a message they did not see a price for.
A few other things make this feel like part of Octeth rather than a separate tool bolted on:
- Merge tags work the same way as in email. An SMS can say {{ Subscriber:FirstName | "there" }}, with autocomplete in the message box. Messages are rendered as plain text, so a name with an apostrophe arrives on the handset as it was typed.
- SMS activity is a segment rule. Segments, the subscriber filter and campaign recipients can target contacts who were sent, delivered, failed, clicked, replied or opted out, for one SMS campaign or for any SMS, with an optional time window or count. "Everyone who clicked last week's SMS but has not opened an email this month" is now a segment you can build.
- Phone-only contacts make sense on screen. A contact with a phone number and no email address shows only the fields that apply to them, shows their SMS history on the activity tab, can be found by the number as it is displayed, and is exported without a placeholder email address.
Xeebi, And Gateways That Share An Account
Xeebi is now available as an SMS gateway, with delivery reports, inbound replies and automatic opt-out handling.
Several gateways in Octeth can share one Xeebi account, each with its own sender numbers and its own short link domain. This matters if you run Octeth for many clients: you can keep one provider contract and still give each client their own numbers and link domain. Every delivery report and every reply still finds its way back to the gateway that sent the original message, so one client never sees another client's replies.
Signed License Keys And The Community Edition
Octeth now reads its edition and limits from a signed license key. Keys are issued from the new client area at my.octeth.com, which we launched last week, and you paste yours on Settings > License.
The other half of this change is the Community Edition. An installation without a valid key runs as Community Edition, with one user account and 10,000 active subscribers. That is enough to install Octeth, run it on a real list and decide whether it fits, without talking to us first. When you outgrow it, a license key lifts the limits without reinstalling anything.
Existing customers are not cut off by this. An upgraded installation without a signed key keeps working for a 30-day grace period, and your key is waiting in the client area.
A Health Report For Every Sender Domain
Administrators now have a sender domain health report. It lists every sender domain across all accounts, with the result of the latest DNS check for each record, and the reason a domain is waiting for approval: it is new, or it was demoted after a DNS change. A Re-check now action runs the check again on the spot.
Before this report, answering "which of my clients' domains are broken right now?" meant opening accounts one at a time. On an installation with hundreds of client accounts, nobody did that until a client complained. Now it is one screen.
Two smaller additions sit next to it. The DNS tab and the add-domain wizard can copy or download every record as a zone file that providers such as Cloudflare can import, and Octeth checks the certificate of each custom tracking domain in the background and warns the owner when it fails.
Deciding Who Sends Through The Email Gateway
The email gateway is the part of Octeth that sends transactional and API email on behalf of your clients. In this release we tightened who can use it and how much.
- Trusted accounts. By default, the gateway and journeys now send only for accounts an administrator has marked Trusted. A new signup can log in and set things up, but its gateway and journey mail is refused until someone has looked at the account. For anyone running Octeth as a platform for paying customers, this is the difference between reviewing a new account before it sends and finding out from a blocklist afterwards.
- A kill switch that works. Disabling an account or deactivating a sender domain now stops gateway sending immediately, including email that is already queued. Before, a disabled account could still drain its queue.
- Rate limits. User group send limits and the daily email limit now apply to gateway sends.
We also added an alert for a failure that is easy to miss: if sends continue but delivery and bounce reports from the mail server stop arriving, Octeth now tells you. Without those reports, bounce and complaint protection is quietly blind.
Security Hardening
v6.0.0 was a full audit of the API. In v6.0.1 we kept going through the areas around it, and fixed what we found.
The user-area IP restriction now applies everywhere a user signs in, not only on the login page. Administrators can revoke "remember me" sign-ins, and changing a password revokes them. More reads and writes by id are checked against the account that owns the record, attachment downloads check ownership too, and URLs supplied by account holders, along with webhook destinations, can no longer point back into your own network. Stored credentials no longer appear in admin pages, API responses or logs, and the installer no longer prints secrets.
None of these change how Octeth works for anyone using it as intended. The changelog lists every item.
Before You Upgrade
Two things deserve attention before you install v6.0.1.
First, gateway and journey email now requires accounts marked Trusted. If some of your clients send through the gateway API or journeys from Untrusted accounts, their mail stops after the upgrade until an administrator marks them Trusted, so review those accounts first. The changelog explains how to keep the previous behaviour instead.
Second, if you already have a signed license key from the client area, the Upgrade Notes in the changelog show how to hand it to the upgrade. You can also paste it on Settings > License afterwards.
This release has other behavior changes for API integrations, including the new SMS merge tag syntax. The changelog and the API behavior changes page cover all of them.
What Comes Next
SMS in Octeth now has an engine, a gateway built for platform operators, and screens your clients can use without asking you for help. I expect we will learn a lot from the first real campaigns sent through it, and the next releases will reflect that. The next one is two weeks from today.
Already an Octeth client? Log in to the Octeth Client Area to download v6.0.1 and get your license key.
Want to see what running your own email and SMS platform looks like? Tell us about your setup through the contact form at octeth.com/demo/ and we will show you.
